312-39V2: Certified SOC Analyst v2

Following a high-priority security incident, you are an Incident Responder at a Cyber Incident Response firm and initiate an internal investigation after reports confirm a serious data breach in which sensitive customer data, including payment details and personal information, was stolen from a critical web server.

You begin analyzing the server logs to reconstruct the attack timeline and determine how the attacker gained access. During the investigation, you find suspicious log activity, including repeated requests attempting to access files and directories outside the web server's root directory. Some requests appear to manipulate URL paths to navigate to restricted system files—a behavior often associated with web-based exploits.

You suspect that a web-server vulnerability was exploited to bypass security restrictions and access unauthorized directories, potentially exposing sensitive configurations and credentials. However, you still need to confirm the exact technique used to conduct this attack. Which type of web application attack might have caused this incident?